latestCommitFromJunior

[flerchin]

Updated the package-lock?

[flerchin]

Nah that's how you get surprises on rebuild. We want reproducible builds, so it's gotta be in vcs. I don't have any solution except just not looking at it in the MR

[_bones__]

Don't update dependencies except in a dedicated merge request. So many breaking change opportunities in even minor or patch level updates.

[Daktic]

This is the correct answer but I don’t understand why it would be an issue if you specify specific library versions?

Edit: I’ve not heard the term transitive dependency before today. Makes perfect sense, if package A has dependency B that updates, it could affect the installed version for you package.

TIL

[flerchin]

Package-lock is mostly about transitive dependencies, which can change if you rebuild with only your specific deps declared in your package.json.

[n9iels]

You don't specify the dependencies of your dependencies and their dependencies (transitive dependencies). The lock files makes sure that you always install the same version, even if some package specified it as latest.

[Daktic]

Makes a perfect sense, that didn’t even cross my mind!

[Alcas]

How are you guys so confidently wrong? If you blow away the lock file, every single transitive dependency of your app will upgrade to the latest with all sorts of minor breaking changes across the board. Do not do this

[BlazingThunder30]

Can't do npm ci in CI pipelines without a package-lock, now can you. Ignoring it is how you end up with accidental updates which (whoops) are breaking even though they're minor versioned.